CVE-2026-63687 Apache Software Foundation CVE debrief

Who should care

Apache CXF users, security teams, and administrators responsible for maintaining and securing systems that utilize Apache CXF should be aware of this vulnerability and take necessary actions to prevent potential security risks. This includes reviewing and updating affected systems, monitoring for potential security incidents, and prioritizing upgrades to patched versions. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, asset inventory and vulnerability management teams should be informed to ensure proper tracking and mitigation of this vulnerability. IT operations and change management teams should plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed. Monitoring, detection, and logs for exposed assets should be reviewed for extra review. Exceptions, retest remediated assets, and close the item only after evidence is documented. Rollback/change windows should be considered for affected systems if necessary. Source tracking should also be implemented to monitor for potential security incidents related to this vulnerability. Overall, a coordinated effort is required across various teams to effectively mitigate this vulnerability and prevent potential security risks. The CVE description indicates that Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. This could allow a client with a validly-signed request JWT to substitute sensitive values, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. Affected systems should be reviewed and updated to prevent potential security risks. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and vulnerability management teams should be informed to ensure proper tracking and mitigation of this vulnerability. IT operations and change management teams should plan for vendor-supported updates or mitigat

Technical summary

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. This could allow a client with a validly-signed request JWT to substitute sensitive values, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. Affected systems should be reviewed and updated to prevent potential security risks.

Defensive priority

Apache CXF users should prioritize upgrading to patched versions to prevent potential security risks.

Recommended defensive actions

• Upgrade to Apache CXF version 4.2.3, 4.1.8, or 3.6.12
• Review and update affected systems
• Monitor for potential security incidents
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE description indicates that Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. This could allow a client with a validly-signed request JWT to substitute sensitive values, undermining PKCE integrity and OpenID Connect replay protection.

Official resources